Microsoft Designing and Implementing Microsoft Azure Networking Solutions - AZ-700 Exam Practice Test

You have an Azure subscription that contains the virtual networks shown in the following table.

You plan to deploy an Azure firewall named AF1 to RG1 in the West US Azure region.
To which virtual networks can you deploy AF1?

Hotspot Question
You have an Azure subscription that contains 20 virtual machines and a virtual network named VNet1.
You plan to provide access to the virtual machines by using Azure Bastion.
You need to configure a subnet for Azure Bastion. The solution must minimize the number of IP addresses required for the subnet.
How should you configure the subnet? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

You fail to establish a Site-to-Site VPN connection between your company's main office and an Azure virtual network.
You need to troubleshoot what prevents you from establishing the IPsec tunnel.
Which diagnostic log should you review?

You have an Azure subscription that contains a distributed web app named App1. App1 is hosted across multiple Azure regions.
You need to recommend a solution for routing user requests to App. The solution must meet the following requirements:
- Support the routing of a user request to a resource based on the URL
of the request.
- Support query string replacement.
- Minimize network latency.
What should you include in the recommendation?

You have an on-premises datacenter in Seattle.
You have an Azure subscription that contains an Azure Network Watcher resource in the West US 2 Azure region.
You need to document network latency between the on-premises datacenter and the West US 2 region and between the on-premises datacenter and the East US 2 public Azure region. The solution must minimize administrative effort.
What should you do first?

Case Study 3 - Contoso, Ltd
Overview
Proseware, Inc. is a financial services company that has a main office in New York City and a branch office in San Francisco.
Existing Environment. Hybrid Environment
Proseware has an on-premises Active Directory Domain Services (AD DS) forest named corp.proseware.com that syncs with a Microsoft Entra tenant named proseware.com.
Proseware has an Azure subscription that is linked to proseware.com.
Proseware has an internal certification authority (CA).
Existing Environment. Network Infrastructure
The offices contain the resources shown in the following table.

NYCNet connects to Azure by using an ExpressRoute circuit.
SFONet connects to Azure by using a Site-to-Site (S2S) VPN.
Existing Environment. Azure Resources
The Azure subscription contains the virtual networks and subnets shown in the following table.

The subscription contains four virtual machines named VM1, VM2, VM3, and VM4. VM1 and VM2 host an app named App1.
VM3 and VM4 host a web app named App2 that is accessed by using a FQDN of app2.proseware.com. Users access app2.proseware.com by using HTTP or HTTPS.
VM1, VM2, and VM4 are connected to SpokeVNet.
The subscription contains Application Gateway resources shown in the following table.

The subscription contains an Azure Front Door Standard profile named FD1. FD1 contains a single origin group that targets APPGW1 by using the default endpoint name.
HubVNet connects to NYCNet by using an ExpressRoute gateway named ERGW1.
Planned Changes and Requirements. Planned Changes
Proseware plans to implement the following changes:
- Deploy an Azure Private DNS Resolver named PRDNS1 to HubVNet and link PRDNS1 to SpokeVNet.
- Create a DNS forwarding ruleset named DNSRS1 and associate DNSRS1 with PRDNS1.
- Deploy Azure Virtual Network Manager and implement the following rules:
- Allow inbound connections on TCP port 3389 from the on-premises networks to SUBNET- JUMPHOSTS.
- Block inbound connections on TCP port 80 from the internet to SpokeVNet.
- Ensure that Azure Virtual Network Manager rules take precedence over conflicting NSG rules.
- Deploy two network virtual appliances (NVAs) named NVA1 and NVA2 to HubVNet.
- Deploy a gateway load balancer named LBGW1 to HubVNet.
- Configure LBGW1 to inspect traffic on TCP ports 443, 1433, and 1434 from LBS1 by using NVA1 and NVA2.
- Ensure that all the traffic to App2 is processed by using FD1.
Planned Changes and Requirements. Connectivity requirements
Proseware identifies the following connectivity requirements:
- Minimize the complexity of the Azure Virtual Network Manager deployment.
- Route traffic between NYCNet and SFONet via the ExpressRoute circuit and the S2S VPN.
- Ensure that remote users on Windows 11 devices can connect to HubVNet by using a Point-to- Site (P2S) VPN and their proseware.com credentials.
Planned Changes and Requirements. Security requirements
Proseware identifies the following security requirements:
- Whenever possible, use the internal CA.
- Ensure that all connections routed via APPGW1 use end-to-end encryption.
- Ensure that user connections to Azure-hosted apps use end-to-end encryption.
- Ensure that all inbound internet traffic to app2.proseware.com is routed via FD1.
- Prevent devices that connect to NYCNet from accessing Azure services that use private endpoints.
- Enable the virtual machines that connect to HubVNet and SpokeVNet to access Azure services that use private endpoints.
Planned Changes and Requirements. General requirements
Proseware identifies the following general requirements:
- Minimize the IP address space required to deploy platform-managed resources to the virtual networks.
- From SpokeVNet, resolve name resolution requests for the azure.proseware.com namespace and the corp.proseware.com namespace by using PRDNS1.
- Whenever possible, minimize administrative effort.
You need to configure APPGW1 to support end-to-end encryption. The solution must meet the security requirements.
What should you do?

Drag and Drop Question
You have two Azure subscriptions named Sub1 and Sub2 that contain the resources shown in the following table.

VNet1 and VNet2 are NOT connected.
You plan to create an Azure Private Link service named Link1 that will be used to connect VNet1 and VNet2.
You need to ensure that Link1 meets the following requirements:
- Ensures that VM1 can connect only to a web app hosted on VM2
- Prevents VM1 from connecting to the other resources that are
connected to VNet2
Which additional resources should you create for each virtual network? To answer, drag the appropriate resources to the correct virtual networks. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

A listener is considered a logical entity responsible for checking the incoming connection requests with the help of the protocol, host, port, and IP address. When you decide to create a new listener, you have to choose between a basic and multi-site.
Scenario: You want that the incoming requests are forwarded to different backend pools depending upon the host names or host header.
Solution. You choose a Basic listener.
Is it the right choice?

Hotspot Question
You have an on-premises web server that hosts a web app named App1 and has the following configurations:
- IP address: 131.107.50.60
- FQDN: server1.contoso.com
You have an Azure subscription.
You need to publish App1 by using Azure Front Door. The solution must meet the following requirements:
- Ensure that internet users can connect to App1 by using an FQDN of
app1.contoso.com.
- Minimize the changes required to the configuration of Front Door if
Server1 is migrated to Azure.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

An ExpressRoute circuit denotes the logical connectivity between MS cloud services and on- premises infrastructure via a connectivity provider. Which of the following statement(s) is/are true about the ExpressRoute circuits?

Hotspot Question
You recently migrated your organization's critical applications to Azure. The virtual machines running the applications are distributed across three virtual networks: VNet1, VNet2, and VNet3.
The company has two sites: the head office and the branch office. See the exhibit for the current set-up.

The company wants to modernize its existing infrastructure, for which they plan to migrate to the Azure Virtual WAN to link up all their global networks. It decides to create a global WAN entity, named VWAN-CompanyA, in the Azure portal.
The virtual WAN needs to support virtual networks, ExpressRoute, site-to-site (S2S) and point-to- site (P2S) VPN connectivity.
The head office will be connected to the virtual WAN via a S2S VPN connection, and the branch office will be connected to the virtual WAN via an Azure ExpressRoute connection.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Hotspot Question
You have the Azure environment shown in the exhibit.

You have virtual network peering between Vnet1 and Vnet2. You have virtual network peering between Vnet4 and Vnet5. The virtual network peering is configured as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Hotspot Question
You have two Azure virtual networks named Vnet1 and Vnet2 in an Azure region that has three availability zones.
You deploy 12 virtual machines to each virtual network, deploying four virtual machines per zone.
The virtual machines in Vnet1 host an app named App1. The virtual machines in Vnet2 host an app named App2.
You plan to use Azure Virtual Network NAT to implement outbound connectivity for App1 and App2.
You need to identify the minimum number of subnets and Virtual Network NAT instances required to meet the following requirements:
- A failure of two zones must NOT affect the availability of either
App1 or App2.
- A failure of two zones must NOT affect the outbound connectivity of
either App1 or App2.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

You have an on-premises DNS server named Server that hosts a primary DNS zone named fabrikam.com.
You have an Azure subscription that contains the resources shown in the following table.

Users on the on-premises network access resources on all the virtual networks by using a Site-to- Site (S2S) VPN.
You need to deploy an Azure DNS Private Resolver solution that meets the following requirements:
- Resources connected to the virtual networks must be able to resolve
DNS names for fabrikam.com.
- Server1 must be able to resolve the DNS names of the resources in
contoso.com.
- The solution must minimize costs and administrative effort.
What is the minimum number of resolvers you should deploy?